internal/

Package acme is the ACME server (RFC 8555) for the internal CAs (PHASE2).

Package agent is myownpki-agent on a host (docs/PHASE3.md): it enrolls with proof of control (ADR-18), keeps its 7-day agent certificate, and – from block C on – gets certificates by ACME and deploys them.

Package agentdist maps the exact server release to its immutable agent artifacts.

Package agentpath holds the one path rule the agent and the server share: which directories "myownpki-agent deployment add" refuses to make writable (docs/PHASE3.md section 11.2).

Package agents is the server side of myownpki-agent (docs/PHASE3.md): join tokens, enrollment with proof of control (ADR-18), the agents' 7-day certificates from the agent CA, their names, disable and revoke.

Package analysis finds the oddities of a PKI that no alarm covers: a certificate nobody serves, two sources issuing for the same names, a renewal loop, a wave of expiries, a weak key, a CA that ends before the certificates it issues (docs/PHASE3.md section 14).

Package audit writes and verifies the hash-chained audit logs (PLAN §5, security.md "Audit log").

Package auth signs users in to the admin listener (PHASE1 step 10, security.md "Authentication"): Argon2id passwords, TOTP (RFC 6238), recovery codes, server-side sessions, CSRF protection, throttling and lockout.

Package authz decides who may do what (security.md "Authorization", PHASE1 step 10).

Package backup makes, checks and restores backups of an instance (PHASE1 step 16): every database as one consistent copy (VACUUM INTO, also while the server runs), the audit databases last, a manifest with SHA-256 per file and the head of every audit chain.

Package ca is the CA engine: it issues end-entity certificates from a preset, after checking everything a request contains (PHASE1 step 7).

Package clock provides the injectable clock (go-conventions.md "Time").

Package config loads the server configuration: one YAML file, decoded strictly, plus MYOWNPKI_* environment overrides (go-conventions.md "Configuration", PLAN §14).

Package gen holds generated code: the agent protocol (proto/, ADR-10), generated by buf with protoc-gen-go and protoc-gen-connect-go.

Package httpapi is the REST API of the admin listener (api/openapi.yaml, PHASE1 step 13): hand-written on net/http and encoding/json.

Package ids creates the opaque IDs of database rows (PHASE1 §1: "ULID-like").

Package keys holds the key hierarchy of the online CA keys (PLAN §5 "Keys", security.md "Key storage"):

Package monitor finds what needs an admin – expiring certificates, CA certificates and CRLs, a sealed server, silent agents, failed deployments – keeps it as alerts in system.db and (step 23) tells someone about it (docs/PHASE3.md §9).

Package netguard is the one place that decides where the server may connect on behalf of somebody else's input (security.md "ACME validation = outbound requests to attacker-chosen names").

Package notify tells someone about alerts (docs/PHASE3.md §9.3): one digest per evaluation and channel, sent by e-mail (net/smtp) or as a signed webhook, queued in system.db with retries.

Package pkcs12 writes PKCS#12 files (RFC 7292) for the key export (PHASE1 step 18): the private key in a PBES2-encrypted bag (PBKDF2 with HMAC-SHA256, AES-256-CBC), the certificates in a plain bag, and an HMAC-SHA256 integrity MAC – what OpenSSL 3 writes by default and what Windows 10 (1709+), macOS, Java and OpenSSL import.

Package predecessor defines how a replacement handles its predecessor.

Package publish serves what certificates point to: CA certificates (AIA caIssuers) and CRLs (CRL distribution point) – plain HTTP on the public listener, no login (PHASE1 step 9; wired into the listener in step 12).

Package recipe holds the ready-made deployments behind "myownpki-agent deployment add --recipe NAME" (docs/PHASE3.md §11.2): file paths, owners, modes, hooks, the local TLS check and the directories the hooks need in the systemd sandbox.

Package report builds the datasets of the Reports page and GET /reports (docs/PHASE3.md section 14): the expiry forecast, the issuances per week by source, the certificates per CA and status, the alert history and the agent fleet.

Package server runs MyOwnPKI (PHASE1 step 12): the admin listener with TLS, the public listener for CRLs and CA certificates, and the background jobs (audit delivery and checkpoints, CRL renewal, clean-ups).

Package setup is myownpki init (PHASE1 step 11): unseal passphrase, recovery key, auth key, the first user with TOTP and – optionally – an online test CA.

Package store opens the SQLite databases (ADR-06), keeps their schemas migrated and knows where each file lives in the data directory (PLAN §4).

Package tenant holds the settings of a tenant (PHASE1 step 18): whether the server may generate keys, and the subject defaults that fill empty fields of a request – what pki.conf of legacy/pki.sh did.

Package testinstance builds an initialized instance for tests of the HTTP layers (API, web UI): init --demo with the test CA, the services wired like the server does, a fake clock and helpers for users and TOTP codes.

Package testutil holds helpers that tests of several packages share.

Package tlsscan connects to the TLS endpoints an admin entered, reads the certificate each one serves and compares it with what this PKI issued for the name (docs/PHASE3.md §10) – it finds the renewal that never reached the web server.

Package trustkit builds what the public trust portal hands to a person who wants to trust a root of this PKI: the configuration profile for iPhone, iPad and Mac and the per-platform steps and commands (v0.3.9).

Package version reports how a MyOwnPKI binary was built.

Package web serves the admin UI: templ pages, the embedded static assets and the security headers every response gets.